A CPR number is Denmark’s 10-digit civil registration identifier. It is used across public services to distinguish one person from another, much like a core identity key in government systems. Because it is stable and widely recognized, it can connect records for taxation, healthcare, benefits, and other official interactions.
In cyber security, a CPR number matters because it is hard to treat like a secret once exposed. When paired with a name or address, it can support impersonation, targeted phishing, and cross-database correlation. Attackers may use it to make fraudulent messages seem official or to join leaked datasets into fuller identity profiles. Defenders therefore treat CPR-linked data as sensitive, limit who can query it, watch for unusual bulk lookups, and log exports carefully. Unlike a password, a national identifier usually cannot be changed, so preventing exposure and misuse is far more important than trying to “reset” it after a leak.